diff --git a/.github/workflows/build-pelican.yml b/.github/workflows/build-pelican.yml
index f96b88f..45997af 100644
--- a/.github/workflows/build-pelican.yml
+++ b/.github/workflows/build-pelican.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write   # because we push to asf-site
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
         with:
           persist-credentials: true
           # This must equal the push/branches list above, and be appropriate for the destination below
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 96a66b4..69463f0 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
         with:
           persist-credentials: false
       - name: Install